fix: reject client-supplied system messages

[Jo-anny]

Reject Client-Supplied System Messages in AI Chat

Summary

Reject client-supplied system role messages from public AI chat requests.

• Restrict client-provided messages to user and assistant roles.
• Keep server-generated search context on a separate trusted path with explicit precedence over client history.
• Align role validation across Express, Vercel, browser, and MCP runtimes.
• Preserve existing x402 settlement semantics for paid routes.

Changes

• Added validation to prevent clients from injecting or appending system messages.
• Ensured server-generated search context cannot be overridden by untrusted client messages.
• Added precedence and role-injection regression tests.
• Updated automated coverage for the affected chat paths and runtime boundaries.
• Updated documentation to reflect the accepted message roles and trusted-context behavior.

Security Impact

This closes a prompt-trust boundary where a public client could previously append arbitrary system messages and influence application-level behavior.

Only server-generated system/search context is now trusted.

Testing

• Client-supplied system messages are rejected.
• user and assistant messages remain supported.
• Server-generated search context retains precedence.
• Cross-runtime behavior remains consistent.
• Paid routes retain verified x402 settlement behavior.

Related Issue

Closes #183

[vercel]

@Jo-anny is attempting to deploy a commit to the Emmanuel's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Jo-anny Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits